Binance Reimburses 90% of $6.3 Billion Stolen in Crypto Hack
The exchange says it has restored major-token losses as US officials examine the FBI’s attribution of the attack to North Korea.
Binance has reimbursed customers for 90% of the funds stolen in a $6.3 billion cyberattack, limiting the immediate financial damage to users while leaving the world’s largest cryptocurrency exchange with a substantial residual compensation obligation.
The company said on October 31 that it had fully covered losses involving BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% consists of tokens outside the 10 largest cryptoassets, according to Binance. Because those tokens have lower liquidity, purchasing enough of them to compensate customers in full will require more time, the platform said.
The disclosed reimbursement rate implies that Binance has already replaced the large majority of assets taken in the October 29 attack. The company did not provide a detailed breakdown of the compensation by token, disclose the remaining amount on a dollar basis or specify when all affected customers would be made whole.
Reimbursement raises balance-sheet questions
The scale of the theft and Binance’s decision to compensate customers place renewed focus on the exchange’s liquidity, reserves and ability to absorb an exceptional loss. In 2024, the company reported that it held more than $160 billion in assets under management. Estimates indicate that more than 300 million users are registered on the exchange worldwide.
Against that reported asset base, the approximately $6.3 billion theft represents a material operational event, even though assets under management are not equivalent to corporate revenue, equity or unrestricted cash. Binance has not disclosed in the statement cited how the reimbursements were financed, whether insurance contributed, or what portion was covered from company-controlled reserves.
The distinction between highly liquid major tokens and smaller cryptoassets is central to the remaining liability. Binance said it could fully replace losses across the largest named assets, while lower liquidity in other tokens would slow additional purchases. Attempting to acquire thinly traded tokens rapidly could affect market prices and increase the ultimate cost of reimbursement.
FBI attribution disputed by Trump
The Federal Bureau of Investigation said on Saturday, October 31, that North Korean hackers were responsible for the attack on Binance and the theft of about $6.3 billion from its customers, an amount exceeding €5.6 billion. The agency attributed the operation to TraderTraitor, a North Korean hacking group.
US President Donald Trump questioned that assessment on November 1 while speaking to journalists at his Mar-a-Lago estate in Florida.
“We are looking into it now. We don’t know whether it is connected to North Korea, but if it is, we will discuss the matter with North Korea,” Trump said.
Trump’s comments leave the US government’s public position unsettled despite the FBI’s attribution. The president did not offer an alternative explanation for the attack, saying that authorities were still examining whether North Korea was involved.
According to the FBI, TraderTraitor members typically convert stolen funds into Ethereum and then launder the assets, including through instant cryptocurrency exchange services. Such conversions can complicate asset recovery by moving proceeds across wallets, tokens and trading platforms.
Transaction controls and recovery prospects
The FBI urged companies that process cryptoasset transactions to block transfers involving wallets linked to TraderTraitor. Law enforcement officials included a list of the relevant wallets in their press release. The effectiveness of those measures will depend partly on how quickly exchanges, trading services and other intermediaries identify and restrict the flagged addresses.
For Binance, the financial outcome will be determined not only by the cost of customer reimbursement but also by whether any stolen assets can be frozen or recovered. Successful recovery could reduce the exchange’s net loss after compensation, while continued laundering through rapid exchange services could make that more difficult.
The episode also creates investor-relations and disclosure challenges for a privately held exchange operating at global scale. Users and market participants are likely to seek more information about reserve adequacy, custody controls, insurance arrangements and the accounting treatment of reimbursements. Binance’s statement establishes that customers holding the 10 specified major tokens have been fully compensated, but it leaves open the timing and cost of resolving losses in less liquid assets.
With 10% of stolen funds still awaiting reimbursement, Binance’s next financial update will be closely watched for evidence of the final compensation cost and any recovered assets. The competing public statements over attribution add a geopolitical dimension, but the near-term financial issue remains the exchange’s ability to complete restitution without disrupting liquidity in smaller token markets.
